67453f543db5818fe7cb2eff9a09f8ec4df4d0217ed1c5fc86a61f245dedd345

Resubmissions

20/04/2024, 08:03

240420-jxzm5acg3z 3

20/04/2024, 08:01

240420-jwh9racf9t 7

Analysis

max time kernel
147s
max time network
152s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20/04/2024, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Orbit/Zappericons-Regular.ttf
Size

3KB
MD5

6171764d98cd619bc54dff71fbdb646b
SHA1

578f0ae0a40c66950a87a76cc020ab22d5008288
SHA256

3c5f8071d0897b8c0dd694704b1cc4c051609c98a154e88a088e8e9ccf2fa56a
SHA512

52a35bde5e17f5d79fcf449b8c71243e7d51e6c984a54ae4058d460ce8bd6c4b55f474ee486e5a7fa3ddd2a9a5ced47ccd58dbd2011010d98fd69cf183f63b48

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4924	4236	cmd.exe	73
PID 4236 wrote to memory of 4924	4236	cmd.exe	73

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Orbit\Zappericons-Regular.ttf
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Orbit\Zappericons-Regular.ttf
  2⤵
  PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...